[go: up one dir, main page]
More Web Proxy on the site http://driver.im/

EP3661819B1 - Control system for a motor vehicle, motor vehicle, method for controlling a motor vehicle, computer program product, and computer-readable medium - Google Patents

Control system for a motor vehicle, motor vehicle, method for controlling a motor vehicle, computer program product, and computer-readable medium Download PDF

Info

Publication number
EP3661819B1
EP3661819B1 EP18742995.6A EP18742995A EP3661819B1 EP 3661819 B1 EP3661819 B1 EP 3661819B1 EP 18742995 A EP18742995 A EP 18742995A EP 3661819 B1 EP3661819 B1 EP 3661819B1
Authority
EP
European Patent Office
Prior art keywords
control unit
motor vehicle
function
control device
signal
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
EP18742995.6A
Other languages
German (de)
French (fr)
Other versions
EP3661819A1 (en
Inventor
Sergey Orlov
Carsten KÜGELER
Ulrich KÖHLER
Peter GRABS
Matthias KORTE
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Hella GmbH and Co KGaA
Original Assignee
Hella GmbH and Co KGaA
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Hella GmbH and Co KGaA filed Critical Hella GmbH and Co KGaA
Publication of EP3661819A1 publication Critical patent/EP3661819A1/en
Application granted granted Critical
Publication of EP3661819B1 publication Critical patent/EP3661819B1/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
    • B60W50/00—Details of control systems for road vehicle drive control not related to the control of a particular sub-unit, e.g. process diagnostic or vehicle driver interfaces
    • B60W50/02—Ensuring safety in case of control system failures, e.g. by diagnosing, circumventing or fixing failures
    • B60W50/029—Adapting to failures or work around with other constraints, e.g. circumvention by avoiding use of failed parts
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60T—VEHICLE BRAKE CONTROL SYSTEMS OR PARTS THEREOF; BRAKE CONTROL SYSTEMS OR PARTS THEREOF, IN GENERAL; ARRANGEMENT OF BRAKING ELEMENTS ON VEHICLES IN GENERAL; PORTABLE DEVICES FOR PREVENTING UNWANTED MOVEMENT OF VEHICLES; VEHICLE MODIFICATIONS TO FACILITATE COOLING OF BRAKES
    • B60T8/00—Arrangements for adjusting wheel-braking force to meet varying vehicular or ground-surface conditions, e.g. limiting or varying distribution of braking force
    • B60T8/32—Arrangements for adjusting wheel-braking force to meet varying vehicular or ground-surface conditions, e.g. limiting or varying distribution of braking force responsive to a speed condition, e.g. acceleration or deceleration
    • B60T8/88—Arrangements for adjusting wheel-braking force to meet varying vehicular or ground-surface conditions, e.g. limiting or varying distribution of braking force responsive to a speed condition, e.g. acceleration or deceleration with failure responsive means, i.e. means for detecting and indicating faulty operation of the speed responsive control means
    • B60T8/885—Arrangements for adjusting wheel-braking force to meet varying vehicular or ground-surface conditions, e.g. limiting or varying distribution of braking force responsive to a speed condition, e.g. acceleration or deceleration with failure responsive means, i.e. means for detecting and indicating faulty operation of the speed responsive control means using electrical circuitry
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
    • B60W10/00—Conjoint control of vehicle sub-units of different type or different function
    • B60W10/18—Conjoint control of vehicle sub-units of different type or different function including control of braking systems
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
    • B60W10/00—Conjoint control of vehicle sub-units of different type or different function
    • B60W10/20—Conjoint control of vehicle sub-units of different type or different function including control of steering systems
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
    • B60W50/00—Details of control systems for road vehicle drive control not related to the control of a particular sub-unit, e.g. process diagnostic or vehicle driver interfaces
    • B60W50/04—Monitoring the functioning of the control system
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60T—VEHICLE BRAKE CONTROL SYSTEMS OR PARTS THEREOF; BRAKE CONTROL SYSTEMS OR PARTS THEREOF, IN GENERAL; ARRANGEMENT OF BRAKING ELEMENTS ON VEHICLES IN GENERAL; PORTABLE DEVICES FOR PREVENTING UNWANTED MOVEMENT OF VEHICLES; VEHICLE MODIFICATIONS TO FACILITATE COOLING OF BRAKES
    • B60T2260/00—Interaction of vehicle brake system with other systems
    • B60T2260/02—Active Steering, Steer-by-Wire
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60T—VEHICLE BRAKE CONTROL SYSTEMS OR PARTS THEREOF; BRAKE CONTROL SYSTEMS OR PARTS THEREOF, IN GENERAL; ARRANGEMENT OF BRAKING ELEMENTS ON VEHICLES IN GENERAL; PORTABLE DEVICES FOR PREVENTING UNWANTED MOVEMENT OF VEHICLES; VEHICLE MODIFICATIONS TO FACILITATE COOLING OF BRAKES
    • B60T2270/00—Further aspects of brake control systems not otherwise provided for
    • B60T2270/40—Failsafe aspects of brake control systems
    • B60T2270/413—Plausibility monitoring, cross check, redundancy
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
    • B60W50/00—Details of control systems for road vehicle drive control not related to the control of a particular sub-unit, e.g. process diagnostic or vehicle driver interfaces
    • B60W50/02—Ensuring safety in case of control system failures, e.g. by diagnosing, circumventing or fixing failures
    • B60W50/029—Adapting to failures or work around with other constraints, e.g. circumvention by avoiding use of failed parts
    • B60W2050/0292—Fail-safe or redundant systems, e.g. limp-home or backup systems

Definitions

  • the present invention relates to a control system for a motor vehicle according to the preamble of claim 1, a motor vehicle according to the preamble of claim 3, a method for controlling a motor vehicle according to the preamble of claim 4, a computer program product and a computer-readable medium.
  • a control system for a motor vehicle comprising a first control device designed as a brake control device for controlling a first function of the motor vehicle designed as a braking function, a second control device designed as a steering control device for controlling a second function of the motor vehicle designed as a steering function and a reserve control device designed as a central control device, wherein the brake control device and the steering control device are each connected to at least one sensor and / or at least one actuator in a signal-transmitting manner and wherein the brake control device is connected to the central control device in a signal-transmitting manner.
  • emergency braking is initiated and controlled by the central control unit.
  • a motor vehicle with a first control and regulation unit is also known, the motor vehicle preferably having an autonomous driving function, the function for realizing autonomous driving being integrated into a second control and regulation unit. At least some of the functions for realizing autonomous driving are preferably additionally integrated into the first control and Control unit integrated in order to be able to maintain at least basic functions of autonomous driving at least temporarily in the event of an error in the second control and regulation unit.
  • a system for a motor vehicle in which the CAN layout is provided with redundancy.
  • This redundancy provides that in the event that certain modules, for example ECUs, lose power or lose their signal transmission connection to the actuators assigned to these modules, other modules, for example other ECUs, remain connected to these actuators and carry out important functions, such as the braking function or the steering function, maintained.
  • the present invention is based on the object of ensuring the proper execution of functions of a motor vehicle controlled by means of control devices, even in the event of a faulty control device, with as little additional effort as possible.
  • a significant advantage of the invention is, in particular, that functions of a motor vehicle that are different from one another and controlled by control devices can continue to be carried out safely with as little additional effort as possible even in the event of a fault in one of the control devices.
  • at least two functions of the motor vehicle that are different from one another and each controlled by a control device continue to be carried out in the event of a fault in one of the two control devices, without a reserve control device having to be kept available for both control devices. Accordingly, it is possible to save installation space and weight and reduce costs. This is particularly important in modern motor vehicles with a high degree of electrical and electronic functionality, i.e. a large number of functions controlled by control devices.
  • an indirect signal-transmitting connection would also mean that, in the event of an error, the first and/or second control device forwards an error message to a higher-level control device by means of a signal-transmitting connection and the higher-level control device then generates a corresponding output signal and sends this to the error-free control device or that third control unit transmitted.
  • the output signal of the higher-level control device thus leads to a configuration of the error-free control device such that the function of the motor vehicle corresponding to the faulty control device can be controlled by means of the error-free control device.
  • the higher-level control device can be, for example, a central control device.
  • control device is to be understood generally and refers to any type of electrical or electronic device for automatically controlling a function of a motor vehicle.
  • the control system has an operating interface and can be converted from a deactivation state to an activation state depending on the application of an activation signal to the operating interface, the error-free control device in the deactivation state of the control system independently controlling the function of the motor vehicle corresponding to the faulty control device from the input of the error signal at the error-free control device or the third control device is not controlled and in the activation state of the control system, the function of the motor vehicle corresponding to the faulty control device is controlled depending on the input of the error signal at the error-free control device or the third control device.
  • the control system has an operating interface and is transferred from a deactivation state to an activation state depending on the presence of an activation signal at the operating interface, the error-free control device in the deactivation state of the control system corresponding to the faulty control device
  • Corresponding function of the motor vehicle is not controlled regardless of the input of the error signal at the error-free control unit or the third control unit and in the activation state of the control system, the function of the motor vehicle corresponding to the faulty control unit is dependent on the input of the error signal at the error-free control unit or the third control unit controlled.
  • the first function of the motor vehicle controlled by a first control device and the second function of the motor vehicle controlled by a second control device can be freely selected within wide, suitable limits.
  • the first function of the motor vehicle is designed as a braking function of the motor vehicle and the second function of the motor vehicle is designed as a steering function of the motor vehicle.
  • Highly automated or autonomous motor vehicles are motor vehicles in which the driver only carries out a certain control task, if at all.
  • Highly automated or autonomous motor vehicles are designed and set up to participate in road traffic essentially independently of the intervention of a vehicle driver. The driver is more of a passenger than a decision-maker who determines the functions of the motor vehicle.
  • autonomous is to be interpreted broadly to include various degrees of autonomous driving and autonomous motor vehicles.
  • situation-dependent autonomous driving and therefore situation-dependent Autonomously driving motor vehicles are referred to as autonomous driving or not, depending on the traffic situation and/or driving maneuvers to be carried out. Accordingly, one can alternatively speak of automated driving and automated motor vehicles.
  • the first function of the motor vehicle is designed as a braking function of the motor vehicle and the second function of the motor vehicle is designed as a steering function of the motor vehicle.
  • the error-free control device is configured in such a way that it has the function of the motor vehicle that corresponds to the faulty control device in a restricted manner compared to normal operation of this function or that it has the function that corresponds to the error-free control device of the motor vehicle operates in a restricted manner compared to normal operation of this function. In this way, the effort involved in implementing the method according to the invention is reduced.
  • FIG. 1 A first exemplary embodiment of a control system according to the invention for a motor vehicle is shown as an example.
  • the control system has a first control device 2 for a first function and a second control device 4 for a second function of a motor vehicle, not shown in detail.
  • the motor vehicle is designed as a highly automated motor vehicle, in which the functions of the motor vehicle are selected and carried out essentially automatically by the motor vehicle.
  • the first function is designed as a braking function and the second function is designed as a steering function of the motor vehicle. Accordingly, the first control device 2 controls the braking function of the motor vehicle and the second control device 4 controls the steering function of the motor vehicle.
  • the first control device 2 for controlling the braking function of the motor vehicle is in signal transmission connection with first actuators 6 of the motor vehicle designed as brakes and the second control device 4 is in signal transmission connection with a second actuator 8 of the motor vehicle designed as a steering system.
  • the braking function and/or the steering function could involve a different number of actuators.
  • the expert will select and determine the appropriate selection and number of actuators for the respective function of the motor vehicle.
  • the respective signal transmission connection between the first control unit 2 and the brakes 6 and the second control unit 4 and the steering 8 is in the Fig. 1 symbolized by solid arrows 2.1 and 4.1.
  • the brakes 6 and the steering 8 of the motor vehicle are safety-relevant and therefore very important functions of the motor vehicle. This applies to a greater extent to the selected exemplary embodiment, which is an autonomous motor vehicle.
  • the first control device 2 and the second control device 4 are connected to each other in a signal-transmitting manner, which is in the Fig. 1 is symbolized by the double arrow 3.
  • the first control unit 2 is also in signal transmission connection with the steering 8 and the second control unit 4 is also in signal transmission connection with the brakes 6. This is symbolized by the dashed arrows 2.2 and 4.2.
  • the brakes 6 are controlled by means of the first control device 2 for the braking function of the motor vehicle and the steering 8 by means of the second control device 4 for the steering function of the motor vehicle.
  • the need for a braking intervention by the first control device 2 or a steering intervention by the second control device 4 is determined in the first control device 2 or in the second control device 4 or in a control device superordinate to the respective control device 2, 4 in a manner known to those skilled in the art based on the
  • the input signals from the motor vehicle sensors present in the corresponding control unit are decided. Both any higher-level control unit and the motor vehicle's sensors are in the Fig. 1 not shown.
  • the first control device 2 does not intervene in the steering function and the second control device 4 does not intervene in the braking function of the motor vehicle.
  • the first control device 2 monitors the proper functioning of the second control device 4 and the second control device 4 monitors the proper functioning of the first control device 2.
  • 4 a corresponding error signal from the faulty control device 2 or 4 as an input signal.
  • this error is reported to the second control device 4 by means of the signal transmission connection 3, whereupon this second control unit 4 is configured such that it controls the braking function of the motor vehicle; that is, the function of the motor vehicle corresponding to the faulty first control unit 2 is checked.
  • the second control unit 4 exchanges signals with the brakes 6 of the motor vehicle by means of the signal transmission connection 4.2. In the event of a fault in the first control device 2, the brakes 6 are no longer controlled by the first control device 2, but by the second control device 4.
  • the first control device 2 receives a corresponding error message regarding the second control device 4 by means of the signal transmission connection 3, whereupon the first control device 2 is configured such that it controls the steering function of the motor vehicle.
  • the steering 8 is therefore no longer controlled by the faulty second control device 4, but by the first control device 2, namely by means of the signal transmission connection 2.2.
  • Fig. 2 shows a second embodiment. Only the differences from the first exemplary embodiment are explained below. Otherwise, reference is made to the description of the first exemplary embodiment. Components that are the same or have the same effect are given the same reference numbers.
  • the second exemplary embodiment has a third control device 10 in addition to the first and second control devices 2, 4.
  • the third control device 10 is designed as a central control device 10 of the motor vehicle, not shown.
  • the central control device 10 is in signal transmission connection with both the first control device 2 and the second control device 4.
  • Fig. 2 is the signal transmission connection between the central control unit 10 and the first control device 2 are symbolized by a double arrow 10.1 and the signal transmission connection between the central control device 10 and the second control device 4 is symbolized by a double arrow 10.2.
  • the central control device 10 monitors the proper functioning of the first control device 2 and the proper functioning of the second control device 4. In the event of a fault in one of the two control devices 2 and 4, a corresponding error signal from the faulty control device 2 or 4 is present on the central control device 10 as an input signal.
  • the first control device 2 works incorrectly, so that the brakes 6 controlled with it are no longer properly controlled and the braking function of the motor vehicle is no longer carried out safely, this error is reported to the central control device 10 by means of the signal transmission connection 10.1, whereupon this is done by means of the second control device 4, which is in signal exchange with the central control device 10, is configured in the signal transmission connection 10.2 in such a way that it controls the braking function of the motor vehicle; that is, the function of the motor vehicle corresponding to the faulty first control unit 2 is checked.
  • the second control unit 4 exchanges signals with the brakes 6 of the motor vehicle by means of the signal transmission connection 4.2. In the event of a fault in the first control device 2, the brakes 6 are no longer controlled by the first control device 2, but by the second control device 4.
  • the central control device 10 receives a corresponding error message regarding the second control device 4 by means of the signal transmission connection 10.2, whereupon the first control device 2, which is in signal exchange with the central control device 10 by means of the signal transmission connection 10.1, is configured in such a way that it controls the steering function of the motor vehicle.
  • the steering 8 is therefore no longer controlled by the faulty second control device 4, but by the first control device 2, namely by means of the signal transmission connection 2.2.
  • the control system each has an operating interface (not shown) and can be converted from a deactivation state to an activation state depending on the application of an activation signal to the operating interface, with the error-free control device 4 or 2 in the deactivation state of the control system which corresponds to the faulty control device 2 or 4 corresponding function of the motor vehicle is not controlled regardless of the input of the error signal at the error-free control device 4 or 2 or the third control device 10 and in the activation state of the control system the function of the motor vehicle corresponding to the faulty control device 2 or 4 depends on the input of the Error signal in the error-free control device 4 or 2 or the third control device 10 is checked.
  • control system according to the invention for a motor vehicle according to the present exemplary embodiments is present and deactivated in a motor vehicle and could be activated for future use by means of an operating intervention by a vehicle driver, workshop personnel or the like.
  • the motor vehicle prepared according to the invention can then be converted with little effort to autonomous driving and thus to the use of a control system according to the invention and to the use of a method according to the invention for controlling the motor vehicle in its activated state.
  • the invention is not limited to the present exemplary embodiments.
  • the error-free control device controls a rather subordinate function of the motor vehicle during normal operation of the motor vehicle.
  • the error-free control unit could be configured in such a way that it controls the function of the faulty control unit instead of the subordinate function in the event of an error. As in the exemplary embodiment, this could be the braking function or the steering function of the motor vehicle.
  • the error-free control device to control the function corresponding to the faulty control device in addition to the function corresponding to the error-free control device in its normal operation.
  • the error-free control device could control the function of the faulty control device in a type of emergency operation.
  • the opposite case is also fundamentally conceivable, namely that the error-free control device controls the function assigned to this control device in its normal operation in the event of an error in favor of the function of the faulty control device in a type of emergency operation.
  • the invention is not limited to the braking function and steering function of a motor vehicle.
  • the invention can also be used advantageously for other functions of a motor vehicle.

Landscapes

  • Engineering & Computer Science (AREA)
  • Transportation (AREA)
  • Mechanical Engineering (AREA)
  • Automation & Control Theory (AREA)
  • Chemical & Material Sciences (AREA)
  • Combustion & Propulsion (AREA)
  • Human Computer Interaction (AREA)
  • Regulating Braking Force (AREA)
  • Valves And Accessory Devices For Braking Systems (AREA)
  • Steering Control In Accordance With Driving Conditions (AREA)

Description

Die vorliegende Erfindung bezieht sich auf ein Kontrollsystem für ein Kraftfahrzeug nach dem Oberbegriff des Anspruchs 1, ein Kraftfahrzeug nach dem Oberbegriff des Anspruchs 3, ein Verfahren zur Kontrolle eines Kraftfahrzeugs nach dem Oberbegriff des Anspruchs 4, ein Computerprogrammprodukt und ein computerlesbares Medium.The present invention relates to a control system for a motor vehicle according to the preamble of claim 1, a motor vehicle according to the preamble of claim 3, a method for controlling a motor vehicle according to the preamble of claim 4, a computer program product and a computer-readable medium.

Derartige Kontrollsysteme für Kraftfahrzeuge, Kraftfahrzeuge, Verfahren zur Kontrolle von Kraftfahrzeugen, Computerprogrammprodukte und computerlesbares Medien sind aus dem Stand der Technik in zahlreichen Ausführungsvarianten bereits bekannt.Such control systems for motor vehicles, motor vehicles, methods for controlling motor vehicles, computer program products and computer-readable media are already known from the prior art in numerous design variants.

Beispielsweise ist aus der Maschinenübersetzung der FR 2 843 341 B1 ins Englische ein Kontrollsystem für ein Kraftfahrzeug bekannt, umfassend ein erstes als Bremssteuergerät ausgebildetes Steuergerät zur Kontrolle einer als Bremsfunktion ausgebildeten ersten Funktion des Kraftfahrzeugs, ein zweites als Lenksteuergerät ausgebildetes Steuergerät zur Kontrolle einer als Lenkfunktion ausgebildeten zweiten Funktion des Kraftfahrzeugs und ein als Zentralsteuergerät ausgebildetes Reservesteuergerät, wobei das Bremssteuergerät und das Lenksteuergerät jeweils mit mindestens einem Sensor und/oder mindestens einem Aktor signalübertragend verbunden sind und wobei das Bremssteuergerät mit dem Zentralsteuergerät signalübertragend verbunden ist. Im Fehlerfall des Bremssteuergeräts wird eine Notbremsung von dem Zentralsteuergerät eingeleitet und kontrolliert.For example, from machine translation the FR 2 843 341 B1 a control system for a motor vehicle is known in English, comprising a first control device designed as a brake control device for controlling a first function of the motor vehicle designed as a braking function, a second control device designed as a steering control device for controlling a second function of the motor vehicle designed as a steering function and a reserve control device designed as a central control device, wherein the brake control device and the steering control device are each connected to at least one sensor and / or at least one actuator in a signal-transmitting manner and wherein the brake control device is connected to the central control device in a signal-transmitting manner. In the event of a fault in the brake control unit, emergency braking is initiated and controlled by the central control unit.

Aus der DE 10 2014 200 071 A1 ist ferner ein Kraftfahrzeug mit einer ersten Steuer- und Regeleinheit bekannt, wobei das Kraftfahrzeug bevorzugt eine autonome Fahrfunktion aufweist, wobei die Funktion zur Realisierung autonomen Fahrens in eine zweite Steuer- und Regeleinheit integriert ist. Zumindest ein Teil der Funktionen zur Realisierung autonomen Fahrens sind bevorzugt zusätzlich in die erste Steuer- und Regeleinheit integriert, um im Falle eines Fehlers in der zweiten Steuer- und Regeleinheit zumindest Grundfunktionen des autonomen Fahrens zumindest zeitweise aufrecht erhalten zu können.From the DE 10 2014 200 071 A1 a motor vehicle with a first control and regulation unit is also known, the motor vehicle preferably having an autonomous driving function, the function for realizing autonomous driving being integrated into a second control and regulation unit. At least some of the functions for realizing autonomous driving are preferably additionally integrated into the first control and Control unit integrated in order to be able to maintain at least basic functions of autonomous driving at least temporarily in the event of an error in the second control and regulation unit.

Darüber hinaus ist aus der WO 2017 058 707 A1 ein System für ein Kraftfahrzeug bekannt, bei dem das CAN Layout mit einer Redundanz versehen ist. Diese Redundanz sieht vor, dass für den Fall, wenn bestimmte Module, beispielsweise ECU's, stromlos werden oder deren Signalübertragungsverbindung zu den diesen Modulen zugeordneten Aktoren verlieren, andere Module, beispielsweise andere ECU's, mit diesen Aktoren in Verbindung bleiben und wichtige Funktionen, wie die Bremsfunktion oder die Lenkfunktion, aufrecht erhalten.In addition, from the WO 2017 058 707 A1 a system for a motor vehicle is known in which the CAN layout is provided with redundancy. This redundancy provides that in the event that certain modules, for example ECUs, lose power or lose their signal transmission connection to the actuators assigned to these modules, other modules, for example other ECUs, remain connected to these actuators and carry out important functions, such as the braking function or the steering function, maintained.

Schließlich ist aus der WO 2011 032 586 A1 ein Verfahren für ein Kraftfahrzeug bekannt, bei dem die Komponenten des Kraftfahrzeugs redundant und simultan betrieben werden. Bei einem Ausfall der einen Komponente wird deren Funktion durch die entsprechend zugehörige redundante Komponente vollständig übernommen. Die Überwachung eines Ausfalls einer Komponente kann dabei durch eine zusätzliche Überwachungs-Steuereinheit erfolgen.Finally it's out of the WO 2011 032 586 A1 a method for a motor vehicle is known, in which the components of the motor vehicle are operated redundantly and simultaneously. If one component fails, its function is completely taken over by the corresponding redundant component. The monitoring of a component failure can be carried out by an additional monitoring control unit.

Hier setzt die vorliegende Erfindung an.This is where the present invention comes into play.

Der vorliegenden Erfindung liegt die Aufgabe zugrunde, die ordnungsgemäße Ausführung von mittels Steuergeräten kontrollierter Funktionen eines Kraftfahrzeugs auch bei einem fehlerhaften Steuergerät bei möglichst geringem Zusatzaufwand zu gewährleisten.The present invention is based on the object of ensuring the proper execution of functions of a motor vehicle controlled by means of control devices, even in the event of a faulty control device, with as little additional effort as possible.

Diese Aufgabe wird durch ein Kontrollsystem mit den Merkmalen des Anspruchs 1, ein Kraftfahrzeug mit den Merkmalen des Anspruchs 3, ein Verfahren mit den Merkmalen des Anspruchs 4, ein Computerprogrammprodukt mit den Merkmalen des Anspruchs 7 und ein computerlesbares Medium mit den Merkmalen des Anspruchs 8 gelöst. Die Unteransprüche betreffen vorteilhafte Weiterbildungen der Erfindung.This object is achieved by a control system with the features of claim 1, a motor vehicle with the features of claim 3, a method with the features of claim 4, a computer program product with the features of claim 7 and a computer-readable medium with the features of claim 8 . The subclaims relate to advantageous developments of the invention.

Ein wesentlicher Vorteil der Erfindung liegt insbesondere darin, dass voneinander verschiedene und mittels Steuergeräten kontrollierte Funktionen eines Kraftfahrzeugs auch im Fehlerfall eines der Steuergeräte mit einem möglichst geringen Mehraufwand sicher weiter ausgeführt werden. Dabei werden mindestens zwei voneinander verschiedene und jeweils durch ein Steuergerät kontrollierte Funktionen des Kraftfahrzeugs im Fehlerfall eines der beiden Steuergeräte weiter ausgeführt, ohne dass für beide Steuergeräte jeweils ein Reservesteuergerät vorgehalten werden müsste. Entsprechend ist es möglich, Bauraum und Gewicht einzusparen sowie die Kosten zu reduzieren. Gerade bei modernen Kraftfahrzeugen mit einem hohen Grad an elektrisch und elektronisch ausgebildeter Funktionalität, also einer Vielzahl von mittels Steuergeräten kontrollierten Funktionen, ist dies sehr wichtig.A significant advantage of the invention is, in particular, that functions of a motor vehicle that are different from one another and controlled by control devices can continue to be carried out safely with as little additional effort as possible even in the event of a fault in one of the control devices. In this case, at least two functions of the motor vehicle that are different from one another and each controlled by a control device continue to be carried out in the event of a fault in one of the two control devices, without a reserve control device having to be kept available for both control devices. Accordingly, it is possible to save installation space and weight and reduce costs. This is particularly important in modern motor vehicles with a high degree of electrical and electronic functionality, i.e. a large number of functions controlled by control devices.

Die Formulierungen gemäß der Kennzeichen der Ansprüche 1 und 4, wonach das erste und das zweite Steuergerät miteinander oder jeweils mit dem dritten Steuergerät signalübertragend verbunden sind, sind allgemein auszulegen. Anstelle direkter signalübertragender Verbindungen sind auch indirekte signalübertragende Verbindungen denkbar.The formulations according to the characteristics of claims 1 and 4, according to which the first and second control devices are connected to each other or to the third control device in a signal-transmitting manner, are to be interpreted in general terms. Instead of direct signal-transmitting connections, indirect signal-transmitting connections are also conceivable.

Beispielsweise wäre unter einer indirekten signalübertragenden Verbindung auch zu verstehen, dass das erste und/oder zweite Steuergerät im jeweiligen Fehlerfall eine Fehlermeldung mittels einer signalübertragenden Verbindung an ein übergeordnetes Steuergerät weiterleitet und das übergeordnete Steuergerät dann ein entsprechendes Ausgangssignal erzeugt und dieses an das fehlerfreie Steuergerät oder das dritte Steuergerät übermittelt. Somit führt das Ausgangssignal des übergeordneten Steuergeräts zu einer Konfiguration des fehlerfreien Steuergeräts derart, dass mittels des fehlerfreien Steuergeräts die zu dem fehlerhaften Steuergerät korrespondierende Funktion des Kraftfahrzeugs kontrollierbar ist. Entsprechendes gilt für das erfindungsgemäße Verfahren, wonach das fehlerfreie Steuergerät in Abhängigkeit des Ausgangssignals des übergeordneten Steuergeräts die zu dem fehlerhaften Steuergerät korrespondierende Funktion des Kraftfahrzeugs kontrolliert. Bei dem übergeordneten Steuergerät kann es sich beispielsweise um ein Zentralsteuergerät handeln.For example, an indirect signal-transmitting connection would also mean that, in the event of an error, the first and/or second control device forwards an error message to a higher-level control device by means of a signal-transmitting connection and the higher-level control device then generates a corresponding output signal and sends this to the error-free control device or that third control unit transmitted. The output signal of the higher-level control device thus leads to a configuration of the error-free control device such that the function of the motor vehicle corresponding to the faulty control device can be controlled by means of the error-free control device. The same applies to the method according to the invention, according to which the error-free control device, depending on the output signal of the higher-level control device, responds to the faulty control device Corresponding function of the motor vehicle is checked. The higher-level control device can be, for example, a central control device.

Der Begriff "Steuergerät" ist erfindungsgemäß allgemein zu verstehen und bezeichnet jede Art eines elektrischen oder elektronischen Geräts zur automatischen Kontrolle einer Funktion eines Kraftfahrzeugs.According to the invention, the term “control device” is to be understood generally and refers to any type of electrical or electronic device for automatically controlling a function of a motor vehicle.

Erfindungsgemäß ist es somit vorgesehen, dass das Kontrollsystem eine Bedienungsschnittstelle aufweist und in Abhängigkeit des Anliegens eines Aktivierungssignals an der Bedienungsschnittstelle von einem Deaktivierungszustand in einen Aktivierungszustand überführbar ist, wobei das fehlerfreie Steuergerät in dem Deaktivierungszustand des Kontrollsystems die zu dem fehlerhaften Steuergerät korrespondierende Funktion des Kraftfahrzeugs unabhängig von dem Eingang des Fehlersignals bei dem fehlerfreien Steuergerät oder dem dritten Steuergerät nicht kontrolliert und in dem Aktivierungszustand des Kontrollsystems die zu dem fehlerhaften Steuergerät korrespondierende Funktion des Kraftfahrzeugs in Abhängigkeit von dem Eingang des Fehlersignals bei dem fehlerfreien Steuergerät oder dem dritten Steuergerät kontrolliert. Hierdurch ist es möglich, Kraftfahrzeuge mit dem erfindungsgemäßen Kontrollsystem bereits zu einem Zeitpunkt auszustatten, zu dem beispielsweise autonome Kraftfahrzeuge und damit einhergehende Funktionalitäten gesetzlich noch nicht zulässig sind. Bei einer späteren Gesetzesänderung ist dann eine Umstellung auf einen autonomen Fahrbetrieb des Kraftfahrzeugs und damit auf ein erfindungsgemäßes Kontrollsystem in dessen Aktivierungszustand mit geringem Aufwand möglich.According to the invention, it is thus provided that the control system has an operating interface and can be converted from a deactivation state to an activation state depending on the application of an activation signal to the operating interface, the error-free control device in the deactivation state of the control system independently controlling the function of the motor vehicle corresponding to the faulty control device from the input of the error signal at the error-free control device or the third control device is not controlled and in the activation state of the control system, the function of the motor vehicle corresponding to the faulty control device is controlled depending on the input of the error signal at the error-free control device or the third control device. This makes it possible to equip motor vehicles with the control system according to the invention at a time when, for example, autonomous motor vehicles and the associated functionalities are not yet legally permitted. In the event of a later change in the law, a switch to autonomous driving operation of the motor vehicle and thus to a control system according to the invention in its activated state is then possible with little effort.

Dies ist von Vorteil, wenn es in verschiedenen Staaten voneinander abweichende Gesetzeslagen gibt; beispielsweise in Hinblick auf die Zulässigkeit von autonomen Kraftfahrzeugen. Gemäß der vorgenannten Weiterbildung ist es möglich, trotz abweichender gesetzlicher Bestimmungen in einzelnen Staaten ein bezüglich der erfindungsrelevanten Komponenten einheitliches Kraftfahrzeugmodell zu entwickeln, herzustellen und zu vertreiben.This is an advantage if there are different legal situations in different countries; for example with regard to the admissibility of autonomous motor vehicles. According to the aforementioned further development, it is possible to develop, produce and sell a motor vehicle model that is uniform in terms of the components relevant to the invention, despite different legal provisions in individual states.

Gleiches gilt für das erfindungsgemäße Verfahren zur Kontrolle eine Kraftfahrzeugs, wonach das Kontrollsystem eine Bedienungsschnittstelle aufweist und in Abhängigkeit des Anliegens eines Aktivierungssignals an der Bedienungsschnittstelle von einem Deaktivierungszustand in einen Aktivierungszustand überführt wird, wobei das fehlerfreie Steuergerät in dem Deaktivierungszustand des Kontrollsystems die zu dem fehlerhaften Steuergerät korrespondierende Funktion des Kraftfahrzeugs unabhängig von dem Eingang des Fehlersignals bei dem fehlerfreien Steuergerät oder dem dritten Steuergerät nicht kontrolliert und in dem Aktivierungszustand des Kontrollsystems die zu dem fehlerhaften Steuergerät korrespondierende Funktion des Kraftfahrzeugs in Abhängigkeit von dem Eingang des Fehlersignals bei dem fehlerfreien Steuergerät oder dem dritten Steuergerät kontrolliert.The same applies to the method according to the invention for controlling a motor vehicle, according to which the control system has an operating interface and is transferred from a deactivation state to an activation state depending on the presence of an activation signal at the operating interface, the error-free control device in the deactivation state of the control system corresponding to the faulty control device Corresponding function of the motor vehicle is not controlled regardless of the input of the error signal at the error-free control unit or the third control unit and in the activation state of the control system, the function of the motor vehicle corresponding to the faulty control unit is dependent on the input of the error signal at the error-free control unit or the third control unit controlled.

Grundsätzlich sind die erste durch ein erstes Steuergerät und die zweite durch ein zweites Steuergerät kontrollierte Funktion des Kraftfahrzeugs in weiten geeigneten Grenzen frei wählbar. Eine besonders vorteilhafte Weiterbildung sieht jedoch vor, dass die erste Funktion des Kraftfahrzeugs als Bremsfunktion des Kraftfahrzeugs und die zweite Funktion des Kraftfahrzeugs als Lenkfunktion des Kraftfahrzeugs ausgebildet ist. Hierbei handelt es sich um zentrale und sicherheitsrelevante Funktionen des Kraftfahrzeugs, deren ordnungsgemäße Ausführung besonders bei hochautomatisierten oder autonomen Kraftfahrzeugen von entscheidender Bedeutung ist.In principle, the first function of the motor vehicle controlled by a first control device and the second function of the motor vehicle controlled by a second control device can be freely selected within wide, suitable limits. However, a particularly advantageous development provides that the first function of the motor vehicle is designed as a braking function of the motor vehicle and the second function of the motor vehicle is designed as a steering function of the motor vehicle. These are central and safety-relevant functions of the motor vehicle, the proper execution of which is particularly important in highly automated or autonomous motor vehicles.

Hochautomatisierte oder autonome Kraftfahrzeuge sind Kraftfahrzeuge, bei denen der Fahrzeugführer, wenn überhaupt, lediglich noch eine gewisse Kontrollaufgabe wahrnimmt. Hochautomatisierte oder autonome Kraftfahrzeuge sind also dazu konstruiert und eingerichtet, um im Wesentlichen unabhängig von dem Eingreifen eines Fahrzeugführers am Straßenverkehr teilzunehmen. Der Fahrzeugführer ist mehr ein Passagier als ein die Funktionen des Kraftfahrzeugs bestimmender Entscheider.Highly automated or autonomous motor vehicles are motor vehicles in which the driver only carries out a certain control task, if at all. Highly automated or autonomous motor vehicles are designed and set up to participate in road traffic essentially independently of the intervention of a vehicle driver. The driver is more of a passenger than a decision-maker who determines the functions of the motor vehicle.

Jedoch ist der Begriff "autonom" weit auszulegen, so dass verschiedene Grade von autonomen Fahren und autonomen Kraftfahrzeugen davon umfasst sind. Beispielsweise sei hier ein situationsbedingtes autonomes Fahren und damit situationsbedingt autonom fahrende Kraftfahrzeuge genannt, bei denen je nach Verkehrssituation und/oder durchzuführendem Fahrmanöver ein autonomes Fahren erfolgt oder auch nicht. Entsprechend kann alternativ auch von automatisiertem Fahren und automatisierten Kraftfahrzeugen gesprochen werden.However, the term "autonomous" is to be interpreted broadly to include various degrees of autonomous driving and autonomous motor vehicles. For example, here is situation-dependent autonomous driving and therefore situation-dependent Autonomously driving motor vehicles are referred to as autonomous driving or not, depending on the traffic situation and/or driving maneuvers to be carried out. Accordingly, one can alternatively speak of automated driving and automated motor vehicles.

Analoges gilt für die vorteilhafte Weiterbildung des erfindungsgemäßen Verfahrens, wonach die erste Funktion des Kraftfahrzeugs als Bremsfunktion des Kraftfahrzeugs und die zweite Funktion des Kraftfahrzeugs als Lenkfunktion des Kraftfahrzeugs ausgebildet ist.The same applies to the advantageous development of the method according to the invention, according to which the first function of the motor vehicle is designed as a braking function of the motor vehicle and the second function of the motor vehicle is designed as a steering function of the motor vehicle.

Eine andere vorteilhafte Weiterbildung des erfindungsgemäßen Verfahrens sieht vor, dass das fehlerfreie Steuergerät derart konfiguriert wird, dass es die zu dem fehlerhaften Steuergerät korrespondierende Funktion des Kraftfahrzeugs in einer im Vergleich zu einem Normalbetrieb dieser Funktion eingeschränkten Weise oder dass es die zu dem fehlerfreien Steuergerät korrespondierende Funktion des Kraftfahrzeugs in einer im Vergleich zu einem Normalbetrieb dieser Funktion eingeschränkten Weise betreibt. Auf diese Weise ist der Aufwand bei der Realisierung des erfindungsgemäßen Verfahrens reduziert.Another advantageous development of the method according to the invention provides that the error-free control device is configured in such a way that it has the function of the motor vehicle that corresponds to the faulty control device in a restricted manner compared to normal operation of this function or that it has the function that corresponds to the error-free control device of the motor vehicle operates in a restricted manner compared to normal operation of this function. In this way, the effort involved in implementing the method according to the invention is reduced.

Anhand der beigefügten, grob schematischen Zeichnung wird die Erfindung nachfolgend näher erläutert. Dabei zeigen:

Fig. 1
ein erstes Ausführungsbeispiel eines erfindungsgemäßen Kontrollsystems für ein Kraftfahrzeug und
Fig. 2
ein zweites Ausführungsbeispiel eines erfindungsgemäßen Kontrollsystems für ein Kraftfahrzeug.
The invention is explained in more detail below using the attached, roughly schematic drawing. Show:
Fig. 1
a first embodiment of a control system according to the invention for a motor vehicle and
Fig. 2
a second embodiment of a control system according to the invention for a motor vehicle.

In der Fig. 1 ist ein erstes Ausführungsbeispiel eines erfindungsgemäßen Kontrollsystems für ein Kraftfahrzeug exemplarisch gezeigt. Das Kontrollsystem weist ein erstes Steuergerät 2 für eine erste Funktion und ein zweites Steuergerät 4 für eine zweite Funktion eines nicht näher dargestellten Kraftfahrzeugs auf. Das Kraftfahrzeug ist dabei als ein hochautomatisiertes Kraftfahrzeug ausgebildet, bei dem die Funktionen des Kraftfahrzeugs im Wesentlichen selbsttätig von dem Kraftfahrzeug ausgewählt und ausgeführt werden.In the Fig. 1 A first exemplary embodiment of a control system according to the invention for a motor vehicle is shown as an example. The control system has a first control device 2 for a first function and a second control device 4 for a second function of a motor vehicle, not shown in detail. The motor vehicle is designed as a highly automated motor vehicle, in which the functions of the motor vehicle are selected and carried out essentially automatically by the motor vehicle.

Die erste Funktion ist als Bremsfunktion und die zweite Funktion ist als Lenkfunktion des Kraftfahrzeugs ausgebildet. Entsprechend kontrolliert das erste Steuergerät 2 die Bremsfunktion des Kraftfahrzeugs und das zweite Steuergerät 4 die Lenkfunktion des Kraftfahrzeugs. Das erste Steuergerät 2 zur Kontrolle der Bremsfunktion des Kraftfahrzeugs ist in Signalübertragungsverbindung mit als Bremsen ausgebildeten ersten Aktoren 6 des Kraftfahrzeugs und das zweite Steuergerät 4 ist in Signalübertragungsverbindung mit einem als eine Lenkung ausgebildeten zweiten Aktor 8 des Kraftfahrzeugs.The first function is designed as a braking function and the second function is designed as a steering function of the motor vehicle. Accordingly, the first control device 2 controls the braking function of the motor vehicle and the second control device 4 controls the steering function of the motor vehicle. The first control device 2 for controlling the braking function of the motor vehicle is in signal transmission connection with first actuators 6 of the motor vehicle designed as brakes and the second control device 4 is in signal transmission connection with a second actuator 8 of the motor vehicle designed as a steering system.

In anderen Anwendungsfällen könnte es sich bezüglich der Bremsfunktion und/oder der Lenkfunktion um eine andere Anzahl von Aktoren handeln. Der Fachmann wird je nach Einzelfall die entsprechende Auswahl und Anzahl an Aktoren für die jeweilige Funktion des Kraftfahrzeugs auswählen und festlegen.In other applications, the braking function and/or the steering function could involve a different number of actuators. Depending on the individual case, the expert will select and determine the appropriate selection and number of actuators for the respective function of the motor vehicle.

Die jeweilige Signalübertragungsverbindung zwischen dem ersten Steuergerät 2 und den Bremsen 6 sowie dem zweiten Steuergerät 4 und der Lenkung 8 ist in der Fig. 1 anhand von durchgezogenen Pfeilen 2.1 und 4.1 symbolisiert. Bei den Bremsen 6 und der Lenkung 8 des Kraftfahrzeugs handelt es sich um sicherheitsrelevante und damit sehr wichtige Funktionen des Kraftfahrzeugs. Dies gilt im verstärkten Maße für das gewählte Ausführungsbeispiel, bei dem es sich ja um ein autonomes Kraftfahrzeug handelt.The respective signal transmission connection between the first control unit 2 and the brakes 6 and the second control unit 4 and the steering 8 is in the Fig. 1 symbolized by solid arrows 2.1 and 4.1. The brakes 6 and the steering 8 of the motor vehicle are safety-relevant and therefore very important functions of the motor vehicle. This applies to a greater extent to the selected exemplary embodiment, which is an autonomous motor vehicle.

Damit auch im Fehlerfall eines der Steuergeräte 2 und 4 die Bremsfunktion und die Lenkfunktion des Kraftfahrzeugs ordnungsgemäß und damit sicher ausgeführt werden können, sind das erste Steuergerät 2 und das zweite Steuergerät 4 miteinander signalübertragend verbunden, was in der Fig. 1 durch den Doppelpfeil 3 symbolisiert ist. Gleichzeitig ist das erste Steuergerät 2 auch in Signalübertragungsverbindung mit der Lenkung 8 und das zweite Steuergerät 4 auch in Signalübertragungsverbindung mit den Bremsen 6. Dies ist durch die gestrichelten Pfeile 2.2 und 4.2 symbolisiert.So that even in the event of a fault in one of the control devices 2 and 4, the braking function and the steering function of the motor vehicle are carried out properly and therefore safely can, the first control device 2 and the second control device 4 are connected to each other in a signal-transmitting manner, which is in the Fig. 1 is symbolized by the double arrow 3. At the same time, the first control unit 2 is also in signal transmission connection with the steering 8 and the second control unit 4 is also in signal transmission connection with the brakes 6. This is symbolized by the dashed arrows 2.2 and 4.2.

Im Nachfolgenden wird das erfindungsgemäße Verfahren anhand der Fig. 1 näher erläutert.The method according to the invention is described below using the Fig. 1 explained in more detail.

Im Normalbetrieb des erfindungsgemäßen Kontrollsystems für das autonome Kraftfahrzeug werden die Bremsen 6 mittels des ersten Steuergeräts 2 für die Bremsfunktion des Kraftfahrzeugs und die Lenkung 8 mittels des zweiten Steuergeräts 4 für die Lenkfunktion des Kraftfahrzeugs angesteuert. Die Notwendigkeit eines Bremseingriffes durch das erste Steuergerät 2 oder eines Lenkeingriffes durch das zweite Steuergerät 4 wird in dem ersten Steuergerät 2 oder in dem zweiten Steuergerät 4 oder in einem zu dem jeweiligen Steuergerät 2, 4 übergeordneten Steuergerät auf dem Fachmann bekannte Weise anhand von an dem entsprechenden Steuergerät anliegenden Eingangssignalen von Sensoren des Kraftfahrzeugs entschieden. Sowohl ein etwaiges übergeordnetes Steuergerät wie auch die Sensoren des Kraftfahrzeugs sind in der Fig. 1 nicht dargestellt.During normal operation of the control system according to the invention for the autonomous motor vehicle, the brakes 6 are controlled by means of the first control device 2 for the braking function of the motor vehicle and the steering 8 by means of the second control device 4 for the steering function of the motor vehicle. The need for a braking intervention by the first control device 2 or a steering intervention by the second control device 4 is determined in the first control device 2 or in the second control device 4 or in a control device superordinate to the respective control device 2, 4 in a manner known to those skilled in the art based on the The input signals from the motor vehicle sensors present in the corresponding control unit are decided. Both any higher-level control unit and the motor vehicle's sensors are in the Fig. 1 not shown.

In dem oben beschriebenen Normalbetrieb des erfindungsgemäßen Kontrollsystems gemäß dem vorliegenden Ausführungsbeispiel greifen das erste Steuergerät 2 nicht in die Lenkfunktion und das zweite Steuergerät 4 nicht in die Bremsfunktion des Kraftfahrzeugs ein. Mittels der zwischen dem ersten Steuergerät 2 und dem zweiten Steuergerät 4 existierenden Signalübertragungsverbindung 3 überwacht das erste Steuergerät 2 die ordnungsgemäße Funktion des zweiten Steuergeräts 4 und das zweite Steuergerät 4 die ordnungsgemäße Funktion des ersten Steuergeräts 2. Im Fehlerfall eines der beiden Steuergeräte 2 und 4 liegt an dem jeweils fehlerfreien Steuergerät 2, 4 ein entsprechendes Fehlersignal von dem fehlerhaften Steuergerät 2 oder 4 als Eingangssignal an.In the above-described normal operation of the control system according to the invention according to the present exemplary embodiment, the first control device 2 does not intervene in the steering function and the second control device 4 does not intervene in the braking function of the motor vehicle. By means of the signal transmission connection 3 existing between the first control device 2 and the second control device 4, the first control device 2 monitors the proper functioning of the second control device 4 and the second control device 4 monitors the proper functioning of the first control device 2. In the event of a fault in one of the two control devices 2 and 4 to the error-free control device 2, 4 a corresponding error signal from the faulty control device 2 or 4 as an input signal.

Sollte beispielsweise das erste Steuergerät 2 fehlerhaft arbeiten, so dass die damit kontrollierten Bremsen 6 nicht mehr ordnungsgemäß kontrolliert werden und somit die Bremsfunktion des Kraftfahrzeugs nicht mehr sicher ausgeführt würde, so wird dieser Fehler mittels der Signalübertragungsverbindung 3 an das zweite Steuergerät 4 gemeldet, woraufhin das zweite Steuergerät 4 derart konfiguriert wird, dass dieses die Bremsfunktion des Kraftfahrzeugs kontrolliert; also die zu dem fehlerhaften ersten Steuergerät 2 korrespondierende Funktion des Kraftfahrzeugs kontrolliert. Hierzu steht das zweite Steuergerät 4 mittels der Signalübertragungsverbindung 4.2 mit den Bremsen 6 des Kraftfahrzeugs in Signalaustausch. Die Bremsen 6 werden somit im Fehlerfall des ersten Steuergeräts 2 nicht mehr von dem ersten Steuergerät 2, sondern von dem zweiten Steuergerät 4 kontrolliert.If, for example, the first control device 2 works incorrectly, so that the brakes 6 controlled with it are no longer properly controlled and the braking function of the motor vehicle would therefore no longer be carried out safely, this error is reported to the second control device 4 by means of the signal transmission connection 3, whereupon this second control unit 4 is configured such that it controls the braking function of the motor vehicle; that is, the function of the motor vehicle corresponding to the faulty first control unit 2 is checked. For this purpose, the second control unit 4 exchanges signals with the brakes 6 of the motor vehicle by means of the signal transmission connection 4.2. In the event of a fault in the first control device 2, the brakes 6 are no longer controlled by the first control device 2, but by the second control device 4.

Analoges gilt, falls das zweite Steuergerät 4 fehlerhaft arbeitet. In diesem Fall erhält das erste Steuergerät 2 mittels der Signalübertragungsverbindung 3 eine entsprechende Fehlermeldung bezüglich des zweiten Steuergeräts 4, woraufhin das erste Steuergerät 2 derart konfiguriert wird, dass dieses die Lenkfunktion des Kraftfahrzeugs kontrolliert. Die Lenkung 8 wird somit nicht mehr von dem fehlerhaften zweiten Steuergerät 4, sondern von dem ersten Steuergerät 2 kontrolliert, und zwar mittels der Signalübertragungsverbindung 2.2.The same applies if the second control device 4 works incorrectly. In this case, the first control device 2 receives a corresponding error message regarding the second control device 4 by means of the signal transmission connection 3, whereupon the first control device 2 is configured such that it controls the steering function of the motor vehicle. The steering 8 is therefore no longer controlled by the faulty second control device 4, but by the first control device 2, namely by means of the signal transmission connection 2.2.

Fig. 2 zeigt ein zweites Ausführungsbeispiel. Im Nachfolgenden werden lediglich die Unterschiede zu dem ersten Ausführungsbeispiel erläutert. Ansonsten wird auf die Beschreibung des ersten Ausführungsbeispiels verwiesen. Gleiche oder gleichwirkende Bauteile sind mit gleichen Bezugszeichen versehen. Fig. 2 shows a second embodiment. Only the differences from the first exemplary embodiment are explained below. Otherwise, reference is made to the description of the first exemplary embodiment. Components that are the same or have the same effect are given the same reference numbers.

Im Unterschied zu dem ersten Ausführungsbeispiel weist das zweite Ausführungsbeispiel neben dem ersten und dem zweiten Steuergerät 2, 4 ein drittes Steuergerät 10 auf. Das dritte Steuergerät 10 ist als ein Zentralsteuergerät 10 des nicht dargestellten Kraftfahrzeugs ausgebildet. Das Zentralsteuergerät 10 steht sowohl mit dem ersten Steuergerät 2 wie auch mit dem zweiten Steuergerät 4 in Signalübertragungsverbindung. In Fig. 2 ist die Signalübertragungsverbindung zwischen dem Zentralsteuergerät 10 und dem ersten Steuergerät 2 durch einen Doppelpfeil 10.1 und die Signalübertragungsverbindung zwischen dem Zentralsteuergerät 10 und dem zweiten Steuergerät 4 durch einen Doppelpfeil 10.2 symbolisiert.In contrast to the first exemplary embodiment, the second exemplary embodiment has a third control device 10 in addition to the first and second control devices 2, 4. The third control device 10 is designed as a central control device 10 of the motor vehicle, not shown. The central control device 10 is in signal transmission connection with both the first control device 2 and the second control device 4. In Fig. 2 is the signal transmission connection between the central control unit 10 and the first control device 2 are symbolized by a double arrow 10.1 and the signal transmission connection between the central control device 10 and the second control device 4 is symbolized by a double arrow 10.2.

Mittels der Signalübertragungsverbindungen 10.1 und 10.2 überwacht das Zentralsteuergerät 10 die ordnungsgemäße Funktion des ersten Steuergeräts 2 und die ordnungsgemäße Funktion des zweiten Steuergeräts 4. Im Fehlerfall eines der beiden Steuergeräte 2 und 4 liegt an dem Zentralsteuergerät 10 ein entsprechendes Fehlersignal von dem fehlerhaften Steuergerät 2 oder 4 als Eingangssignal an.By means of the signal transmission connections 10.1 and 10.2, the central control device 10 monitors the proper functioning of the first control device 2 and the proper functioning of the second control device 4. In the event of a fault in one of the two control devices 2 and 4, a corresponding error signal from the faulty control device 2 or 4 is present on the central control device 10 as an input signal.

Sollte beispielsweise das erste Steuergerät 2 fehlerhaft arbeiten, so dass die damit kontrollierten Bremsen 6 nicht mehr ordnungsgemäß kontrolliert werden und somit die Bremsfunktion des Kraftfahrzeugs nicht mehr sicher ausgeführt würde, so wird dieser Fehler mittels der Signalübertragungsverbindung 10.1 an das Zentralsteuergerät 10 gemeldet, woraufhin das mittels der Signalübertragungsverbindung 10.2 mit dem Zentralsteuergerät 10 in Signalaustausch stehende zweite Steuergerät 4 derart konfiguriert wird, dass dieses die Bremsfunktion des Kraftfahrzeugs kontrolliert; also die zu dem fehlerhaften ersten Steuergerät 2 korrespondierende Funktion des Kraftfahrzeugs kontrolliert. Hierzu steht das zweite Steuergerät 4 mittels der Signalübertragungsverbindung 4.2 mit den Bremsen 6 des Kraftfahrzeugs in Signalaustausch. Die Bremsen 6 werden somit im Fehlerfall des ersten Steuergeräts 2 nicht mehr von dem ersten Steuergerät 2, sondern von dem zweiten Steuergerät 4 kontrolliert.If, for example, the first control device 2 works incorrectly, so that the brakes 6 controlled with it are no longer properly controlled and the braking function of the motor vehicle is no longer carried out safely, this error is reported to the central control device 10 by means of the signal transmission connection 10.1, whereupon this is done by means of the second control device 4, which is in signal exchange with the central control device 10, is configured in the signal transmission connection 10.2 in such a way that it controls the braking function of the motor vehicle; that is, the function of the motor vehicle corresponding to the faulty first control unit 2 is checked. For this purpose, the second control unit 4 exchanges signals with the brakes 6 of the motor vehicle by means of the signal transmission connection 4.2. In the event of a fault in the first control device 2, the brakes 6 are no longer controlled by the first control device 2, but by the second control device 4.

Analoges gilt, falls das zweite Steuergerät 4 fehlerhaft arbeitet. In diesem Fall erhält das Zentralsteuergerät 10 mittels der Signalübertragungsverbindung 10.2 eine entsprechende Fehlermeldung bezüglich des zweiten Steuergeräts 4, woraufhin das mittels der Signalübertragungsverbindung 10.1 mit dem Zentralsteuergerät 10 in Signalaustausch stehende erste Steuergerät 2 derart konfiguriert wird, dass dieses die Lenkfunktion des Kraftfahrzeugs kontrolliert. Die Lenkung 8 wird somit nicht mehr von dem fehlerhaften zweiten Steuergerät 4, sondern von dem ersten Steuergerät 2 kontrolliert, und zwar mittels der Signalübertragungsverbindung 2.2.The same applies if the second control device 4 works incorrectly. In this case, the central control device 10 receives a corresponding error message regarding the second control device 4 by means of the signal transmission connection 10.2, whereupon the first control device 2, which is in signal exchange with the central control device 10 by means of the signal transmission connection 10.1, is configured in such a way that it controls the steering function of the motor vehicle. The steering 8 is therefore no longer controlled by the faulty second control device 4, but by the first control device 2, namely by means of the signal transmission connection 2.2.

Bei den vorliegenden Ausführungsbeispielen weist das Kontrollsystem jeweils eine nicht dargestellte Bedienungsschnittstelle auf und ist in Abhängigkeit des Anliegens eines Aktivierungssignals an der Bedienungsschnittstelle von einem Deaktivierungszustand in einen Aktivierungszustand überführbar, wobei das fehlerfreie Steuergerät 4 oder 2 in dem Deaktivierungszustand des Kontrollsystems die zu dem fehlerhaften Steuergerät 2 oder 4 korrespondierende Funktion des Kraftfahrzeugs unabhängig von dem Eingang des Fehlersignals bei dem fehlerfreien Steuergerät 4 oder 2 oder dem dritten Steuergerät 10 nicht kontrolliert und in dem Aktivierungszustand des Kontrollsystems die zu dem fehlerhaften Steuergerät 2 oder 4 korrespondierende Funktion des Kraftfahrzeugs in Abhängigkeit von dem Eingang des Fehlersignals bei dem fehlerfreien Steuergerät 4 oder 2 oder dem dritten Steuergerät 10 kontrolliert.In the present exemplary embodiments, the control system each has an operating interface (not shown) and can be converted from a deactivation state to an activation state depending on the application of an activation signal to the operating interface, with the error-free control device 4 or 2 in the deactivation state of the control system which corresponds to the faulty control device 2 or 4 corresponding function of the motor vehicle is not controlled regardless of the input of the error signal at the error-free control device 4 or 2 or the third control device 10 and in the activation state of the control system the function of the motor vehicle corresponding to the faulty control device 2 or 4 depends on the input of the Error signal in the error-free control device 4 or 2 or the third control device 10 is checked.

Das erfindungsgemäße Kontrollsystem für ein Kraftfahrzeug gemäß den vorliegenden Ausführungsbeispielen ist in einem Kraftfahrzeug vorhanden und deaktiviert und könnte für eine zukünftige Verwendung mittels eines Bedieneingriffs eines Fahrzeugführers, von Werkstattpersonal oder dergleichen, aktiviert werden. Analoges gilt für das erfindungsgemäße Verfahren gemäß den vorliegenden Ausführungsbeispielen zur Kontrolle eines Kraftfahrzeugs.The control system according to the invention for a motor vehicle according to the present exemplary embodiments is present and deactivated in a motor vehicle and could be activated for future use by means of an operating intervention by a vehicle driver, workshop personnel or the like. The same applies to the method according to the invention according to the present exemplary embodiments for checking a motor vehicle.

Dies ist auch deshalb vorteilhaft, da es möglich sein kann, dass autonome Kraftfahrzeuge in manchen Staaten rechtlich noch nicht zugelassen sind. Bei einer späteren Änderung der Gesetzeslage kann dann das gemäß der Erfindung vorbereitete Kraftfahrzeug mit geringem Aufwand auf einen autonomen Fahrbetrieb und damit auf die Verwendung eines erfindungsgemäßen Kontrollsystems sowie auf die Verwendung eines erfindungsgemäßen Verfahrens zur Kontrolle des Kraftfahrzeugs in deren Aktivierungszustand umgestellt werden.This is also advantageous because it may be possible that autonomous vehicles are not yet legally permitted in some states. If the legal situation changes later, the motor vehicle prepared according to the invention can then be converted with little effort to autonomous driving and thus to the use of a control system according to the invention and to the use of a method according to the invention for controlling the motor vehicle in its activated state.

Die Erfindung ist nicht auf die vorliegenden Ausführungsbeispiele begrenzt.The invention is not limited to the present exemplary embodiments.

Beispielsweise wäre es denkbar, dass das fehlerfreie Steuergerät im Normalbetrieb des Kraftfahrzeugs eine eher untergeordnete Funktion des Kraftfahrzeugs kontrolliert. Sollte es dann zu einem Fehlerfall kommen, so könnte das fehlerfreie Steuergerät derart konfiguriert werden, dass es anstelle der untergeordneten Funktion im Fehlerfall die Funktion des fehlerhaften Steuergeräts kontrolliert. Dabei könnte es sich, wie in dem Ausführungsbeispiel, um die Bremsfunktion oder die Lenkfunktion des Kraftfahrzeugs handeln.For example, it would be conceivable that the error-free control device controls a rather subordinate function of the motor vehicle during normal operation of the motor vehicle. Should an error then occur, the error-free control unit could be configured in such a way that it controls the function of the faulty control unit instead of the subordinate function in the event of an error. As in the exemplary embodiment, this could be the braking function or the steering function of the motor vehicle.

In anderen Ausgestaltungen der Erfindung, beispielsweise bei gleichrangigen Funktionen des Kraftfahrzeugs, wäre es jedoch auch denkbar, dass das fehlerfreie Steuergerät die zu dem fehlerhaften Steuergerät korrespondierende Funktion zusätzlich zu der zu dem fehlerfreien Steuergerät in dessen Normalbetrieb korrespondierenden Funktion kontrolliert.However, in other embodiments of the invention, for example with equivalent functions of the motor vehicle, it would also be conceivable for the error-free control device to control the function corresponding to the faulty control device in addition to the function corresponding to the error-free control device in its normal operation.

Ferner könnte das fehlerfreie Steuergerät die Funktion des fehlerhaften Steuergeräts in einer Art Notbetrieb kontrollieren. Auch der umgekehrte Fall ist grundsätzlich denkbar, nämlich dass das fehlerfreie Steuergerät die diesem Steuergerät in dessen Normalbetrieb zugeordnete Funktion in einem Fehlerfall zugunsten der Funktion des fehlerhaften Steuergeräts in einer Art Notbetrieb kontrolliert.Furthermore, the error-free control device could control the function of the faulty control device in a type of emergency operation. The opposite case is also fundamentally conceivable, namely that the error-free control device controls the function assigned to this control device in its normal operation in the event of an error in favor of the function of the faulty control device in a type of emergency operation.

Die Erfindung ist nicht auf die Bremsfunktion und Lenkfunktion eines Kraftfahrzeugs beschränkt. Auch bei anderen Funktionen eines Kraftfahrzeugs ist die Erfindung vorteilhaft anwendbar.The invention is not limited to the braking function and steering function of a motor vehicle. The invention can also be used advantageously for other functions of a motor vehicle.

BezugszeichenlisteReference symbol list

  • 2 Erstes Steuergerät, zur Kontrolle der Bremsfunktion ausgebildet2 First control unit, designed to control the braking function
  • 2.1 Signalübertragungsverbindung zwischen dem ersten Steuergerät 2 und den Bremsen 62.1 Signal transmission connection between the first control unit 2 and the brakes 6
  • 2.2 Signalübertragungsverbindung zwischen dem ersten Steuergerät 2 und der Lenkung 82.2 Signal transmission connection between the first control unit 2 and the steering 8
  • 3 Signalübertragungsverbindung zwischen dem ersten Steuergerät 2 und dem zweiten Steuergerät 43 signal transmission connection between the first control device 2 and the second control device 4
  • 4 Zweites Steuergerät, zur Kontrolle der Lenkfunktion ausgebildet4 Second control unit, designed to control the steering function
  • 4.1 Signalübertragungsverbindung zwischen dem zweiten Steuergerät 4 und der Lenkung 84.1 Signal transmission connection between the second control unit 4 and the steering 8
  • 4.2 Signalübertragungsverbindung zwischen dem zweiten Steuergerät 4 und den Bremsen 64.2 Signal transmission connection between the second control unit 4 and the brakes 6
  • 6 Erste Aktoren, als Bremsen ausgebildet6 First actuators, designed as brakes
  • 8 Zweiter Aktor, als Lenkung ausgebildet8 Second actuator, designed as a steering system
  • 10 Drittes Steuergerät, als Zentralsteuergerät ausgebildet10 Third control device, designed as a central control device
  • 10.1 Signalübertragungsverbindung zwischen dem ersten Steuergerät 2 und dem dritten Steuergerät 1010.1 Signal transmission connection between the first control device 2 and the third control device 10
  • 10.2 Signalübertragungsverbindung zwischen dem zweiten Steuergerät 4 und dem dritten Steuergerät 1010.2 Signal transmission connection between the second control device 4 and the third control device 10

Claims (8)

  1. Control system for a motor vehicle, having a first control unit (2) for controlling a first function of the motor vehicle and a second control unit (4) for controlling a second function of the motor vehicle, the first and second control units (2, 4) each being connected in a signal-transmitting manner to at least one sensor and/or at least one actuator (6, 8), and wherein the first control unit (2) and the second control unit (4) are connected in a signal-transmitting manner or the first and the second control units (2, 4) are each connected in a signal-transmitting manner to a third control unit (10) and, depending on the input of an error signal from the first control unit (2) or the second control unit (4) at the respective error-free control unit (2; 4) or the third control unit (10), the respective fault-free control unit (2; 4) can be configured in such a way that the function of the motor vehicle corresponding to the faulty control unit (4; 2) can be controlled by means of the fault-free control unit (2; 4), wherein the fault-free control unit (2; 4) can be connected in a signal-transmitting manner to the at least one sensor and/or at least one actuator (8; 6) corresponding to the faulty control unit (4; 2), characterized in that
    the control system features an operating interface and can be transferred from a deactivation state to an activation state depending on the presence of an activation signal at the operating interface, wherein the fault-free control unit (2; 4) in the deactivation state does not control the function of the motor vehicle corresponding to the faulty control unit (4; 2) irrespective of the input of the error signal at the fault-free control unit (2; 4) or the third control unit (10) and, in the activation state of the control system, controls the function of the motor vehicle corresponding to the faulty control unit (4; 2) depending on the input of the error signal at the fault-free control unit (2; 4) or the third control unit (10).
  2. Control system in accordance with claim 1,
    characterized in that
    the first function of the motor vehicle is designed as a braking function and the second function of the motor vehicle is designed as a steering function.
  3. Motor vehicle, comprising a control system with a first control unit (2) for controlling a first function of the motor vehicle and a second control unit (4) for controlling a second function of the motor vehicle, wherein the first and second control units (2, 4) are each connected to at least one sensor and/or at least one actuator,
    characterized in that
    the control system is designed in accordance with one of claims 1 or 2.
  4. Method for controlling a motor vehicle, wherein the motor vehicle features a first control unit (2) for controlling a first function of the motor vehicle and a second control unit (4) for controlling a second function of the motor vehicle, wherein the first and second control units (2, 4) are each connected in a signal-transmitting manner to at least one sensor and/or at least one actuator (6, 8), and wherein the first control unit (2) and the second control units (4) are connected in a signal-transmitting manner or the first and the second control units (2, 4) are each connected in a signal-transmitting manner to a third control unit (10) and, depending on the input of an error signal from the first control unit (2) or the second control unit (4) at the respective error-free control unit (2; 4) or the third control unit (10), the respective fault-free control unit (2; 4) is configured in such a way that it controls the function of the motor vehicle corresponding to the faulty control unit (4; 2), wherein the fault-free control unit (2; 4) is connected in a signal-transmitting manner to the at least one sensor and/or at least one actuator (8; 6) corresponding to the faulty control unit (4; 2),
    characterized in that
    the control system features an operating interface and is transferred from a deactivation state to an activation state depending on the presence of an activation signal at the operating interface, wherein the fault-free control unit (2; 4) in the deactivation state of the control system does not control the function of the motor vehicle corresponding to the faulty control unit (4; 2) irrespective of the input of the error signal at the fault-free control unit (2; 4) or the third control unit (10) and, in the activation state of the control system, controls the function of the motor vehicle corresponding to the faulty control unit (4; 2) depending on the input of the error signal at the fault-free control unit (2; 4) or the third control unit (10).
  5. Procedure in accordance with claim 4,
    characterized in that
    the fault-free control unit is configured in such a way that it operates the function of the motor vehicle corresponding to the faulty control unit in a restricted manner in comparison with a normal operation of this function, or in such a way that it operates the function of the motor vehicle corresponding to the fault-free control unit in a restricted manner in comparison with a normal operation of this function.
  6. Procedure in accordance with claim 4 or 5,
    characterized in that
    the first function of the motor vehicle is designed as a braking function and the second function of the motor vehicle is designed as a steering function.
  7. Computer program product comprising commands that cause the control system in accordance with one of claims 1 or 2 to perform the steps of the procedure in accordance with one of claims 4 through 6.
  8. Machine-readable medium on which the computer program product in accordance with claim 7 is stored.
EP18742995.6A 2017-07-31 2018-07-16 Control system for a motor vehicle, motor vehicle, method for controlling a motor vehicle, computer program product, and computer-readable medium Active EP3661819B1 (en)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
DE102017117297.1A DE102017117297A1 (en) 2017-07-31 2017-07-31 Control system for a motor vehicle, motor vehicle, method for controlling a motor vehicle, computer program product and computer-readable medium
PCT/EP2018/069240 WO2019025173A1 (en) 2017-07-31 2018-07-16 Control system for a motor vehicle, motor vehicle, method for controlling a motor vehicle, computer program product, and computer-readable medium

Publications (2)

Publication Number Publication Date
EP3661819A1 EP3661819A1 (en) 2020-06-10
EP3661819B1 true EP3661819B1 (en) 2024-03-20

Family

ID=62976053

Family Applications (1)

Application Number Title Priority Date Filing Date
EP18742995.6A Active EP3661819B1 (en) 2017-07-31 2018-07-16 Control system for a motor vehicle, motor vehicle, method for controlling a motor vehicle, computer program product, and computer-readable medium

Country Status (5)

Country Link
US (1) US11787426B2 (en)
EP (1) EP3661819B1 (en)
CN (1) CN110958965B (en)
DE (1) DE102017117297A1 (en)
WO (1) WO2019025173A1 (en)

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE102019108412A1 (en) 2019-04-01 2020-10-01 Knorr-Bremse Systeme für Nutzfahrzeuge GmbH Method and device for controlling at least one actuator of an actuator system
DE102019116375A1 (en) * 2019-06-17 2020-12-17 Knorr-Bremse Systeme für Nutzfahrzeuge GmbH Device and method for executing at least one vehicle function for a vehicle
DE102021206184A1 (en) 2021-06-17 2022-12-22 Zf Friedrichshafen Ag Mechatronic system architecture for the fusion of a vehicle's steering and braking systems
DE102021126228A1 (en) 2021-10-08 2023-04-13 Zf Active Safety Gmbh Method of operating a braking system, braking system and control system
DE102022206080A1 (en) 2022-06-15 2023-12-21 Robert Bosch Gesellschaft mit beschränkter Haftung Method for operating a computing arrangement

Family Cites Families (20)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
FR2843341B1 (en) 2002-08-08 2005-04-15 Renault Sa DISTRIBUTED CONTROL SYSTEM FOR ELECTRIC DIRECTION DEVICE AND BRAKE DEVICE, IN PARTICULAR FOR VEHICLES
JP4839791B2 (en) * 2005-11-18 2011-12-21 株式会社アドヴィックス Brake control device for vehicle
DE102006062300B4 (en) * 2006-12-18 2011-07-21 Arnold, Roland, 72539 Circuit for controlling an acceleration, braking and steering system of a vehicle
US20080205416A1 (en) * 2007-02-23 2008-08-28 Honeywell International, Inc. Flight control computers with ethernet based cross channel data links
DE112009005234A5 (en) * 2009-09-16 2012-08-23 Anton Weldin METHOD FOR CONTROLLING AN OPERATING SYSTEM AND OPERATING SYSTEM
US8618922B2 (en) * 2010-03-30 2013-12-31 GM Global Technology Operations LLC Method and system for ensuring operation of limited-ability autonomous driving vehicles
DE102012010562B4 (en) * 2012-05-26 2013-12-24 Audi Ag Parking brake system for a vehicle
DE102013225809A1 (en) * 2013-02-27 2014-08-28 Continental Teves Ag & Co. Ohg Brake system for motor vehicles
DE102014200071A1 (en) * 2013-03-05 2014-09-11 Continental Teves Ag & Co. Ohg Brake system for a motor vehicle
AT515454A3 (en) 2013-03-14 2018-07-15 Fts Computertechnik Gmbh Method for handling errors in a central control unit and control unit
DE102013213169A1 (en) * 2013-07-04 2015-01-08 Robert Bosch Gmbh Method and device for operating a motor vehicle in an automated driving operation
DE102014213171A1 (en) * 2014-04-09 2015-10-15 Continental Automotive Gmbh System for autonomous vehicle guidance and motor vehicle
DE102015206572A1 (en) * 2014-05-15 2015-11-19 Continental Teves Ag & Co. Ohg Brake system for motor vehicles
US9710039B2 (en) * 2014-07-17 2017-07-18 International Business Machines Corporation Calculating expected maximum CPU power available for use
CN118816908A (en) * 2015-02-10 2024-10-22 御眼视觉技术有限公司 Sparse map for autonomous vehicle navigation
DE102015203491A1 (en) * 2015-02-26 2016-09-01 Bayerische Motoren Werke Aktiengesellschaft Limp Home Mode for a vehicle with electric drive
CN108025714A (en) 2015-09-28 2018-05-11 法拉第未来公司 The system and method for turning to compensation
US10956393B2 (en) * 2016-10-20 2021-03-23 Hitachi, Ltd. Data storage system and process for providing distributed storage in a scalable cluster system and computer program for such data storage system
EP3363698B1 (en) * 2017-02-15 2021-05-26 Volvo Car Corporation Safety stoppage device and autonomous road vehicle equipped therewith
CN108569142B (en) * 2017-03-10 2022-04-15 法拉第未来公司 System and method for integrating redundant bus architecture into power system

Also Published As

Publication number Publication date
US11787426B2 (en) 2023-10-17
US20200164893A1 (en) 2020-05-28
CN110958965B (en) 2022-03-22
CN110958965A (en) 2020-04-03
WO2019025173A1 (en) 2019-02-07
EP3661819A1 (en) 2020-06-10
DE102017117297A1 (en) 2019-01-31

Similar Documents

Publication Publication Date Title
EP3661819B1 (en) Control system for a motor vehicle, motor vehicle, method for controlling a motor vehicle, computer program product, and computer-readable medium
WO2018130488A1 (en) Control system for a motor vehicle, motor vehicle, method for controlling a motor vehicle, computer program product, and computer-readable medium
DE10243713B4 (en) Redundant control unit arrangement
EP3694759B1 (en) Control system for a motor vehicle, motor vehicle, method for controlling a motor vehicle, computer program product and computer-readable medium
DE69925000T2 (en) FAULT TOLERANT ELECTRONIC BRAKING SYSTEM
EP1989470B1 (en) Safety concept for a transmission actuator device
DE102008024180A1 (en) Combined brake system, especially for motor vehicles
EP2146881A1 (en) Electromechanical brake system with a failsafe energy supply and method for failsafe energy supply in an electromechanical brake system for vehicles
DE102008023628A1 (en) Actuation system for a hydraulically actuated vertical fin and test method for checking the integrity of a positioning system
EP1972514B1 (en) Motor vehicle with an x-by-wire system and method for operating an x-by-wire system of a motor vehicle
DE102018220605B4 (en) Motor vehicle network and method for operating a motor vehicle network
DE102004041672B4 (en) Emergency braking device and braking system for a rail vehicle and method for ensuring an emergency braking function in rail vehicles
DE102020121244A1 (en) Fail-operational system for a vehicle with at least one independent redundant pair of components for controlling a vehicle function, vehicle and method
EP3470301B1 (en) Steering control system for a steering system of a vehicle and a method for operating a steering control system
DE102012219533A1 (en) Brake assembly for motor car, has transmission control unit to output command for securing parking brake device in association with recognized adjustment of shift lever on parking position, to brake control unit over communication bus
DE102016203966A1 (en) Control unit and method for controlling at least one actuator of a vehicle
DE102017112183B4 (en) Control arrangement for steering a rear wheel axle of a vehicle
DE102016117169B4 (en) System for energy and / or data transmission
EP2449438B1 (en) Method and system for driving at least one actuator
DE102015224665A1 (en) Brake system for a vehicle, method for operating a brake system and vehicle having such a brake system
DE102018121396A1 (en) Functional redundancy management system for vehicles and procedures for functional redundancy management
DE102007046731B4 (en) Method for controlling an actuator in a motor vehicle
DE102007046706A1 (en) Control device for vehicles
DE102018112254A1 (en) Control system for a motor vehicle, motor vehicle, method for controlling a motor vehicle, computer program product and computer-readable medium
DE102012212680A1 (en) Method and system for fault-tolerant control of actuators for a limited time based on pre-calculated values

Legal Events

Date Code Title Description
STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: UNKNOWN

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE INTERNATIONAL PUBLICATION HAS BEEN MADE

PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: REQUEST FOR EXAMINATION WAS MADE

17P Request for examination filed

Effective date: 20200211

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

AX Request for extension of the european patent

Extension state: BA ME

DAV Request for validation of the european patent (deleted)
DAX Request for extension of the european patent (deleted)
STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: EXAMINATION IS IN PROGRESS

17Q First examination report despatched

Effective date: 20220517

REG Reference to a national code

Ref document number: 502018014291

Country of ref document: DE

Ref country code: DE

Ref legal event code: R079

Free format text: PREVIOUS MAIN CLASS: B60T0008880000

Ipc: B60W0010180000

GRAP Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOSNIGR1

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: GRANT OF PATENT IS INTENDED

RIC1 Information provided on ipc code assigned before grant

Ipc: B60T 8/88 20060101ALI20231011BHEP

Ipc: B60W 50/029 20120101ALI20231011BHEP

Ipc: B60W 50/04 20060101ALI20231011BHEP

Ipc: B60W 10/20 20060101ALI20231011BHEP

Ipc: B60W 10/18 20120101AFI20231011BHEP

INTG Intention to grant announced

Effective date: 20231030

GRAS Grant fee paid

Free format text: ORIGINAL CODE: EPIDOSNIGR3

GRAA (expected) grant

Free format text: ORIGINAL CODE: 0009210

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE PATENT HAS BEEN GRANTED

AK Designated contracting states

Kind code of ref document: B1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

REG Reference to a national code

Ref country code: GB

Ref legal event code: FG4D

Free format text: NOT ENGLISH

REG Reference to a national code

Ref country code: CH

Ref legal event code: EP

REG Reference to a national code

Ref country code: IE

Ref legal event code: FG4D

Free format text: LANGUAGE OF EP DOCUMENT: GERMAN

REG Reference to a national code

Ref country code: DE

Ref legal event code: R096

Ref document number: 502018014291

Country of ref document: DE

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240320

REG Reference to a national code

Ref country code: LT

Ref legal event code: MG9D

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: GR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240621

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: RS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240620

Ref country code: HR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240320

REG Reference to a national code

Ref country code: NL

Ref legal event code: MP

Effective date: 20240320

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: RS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240620

Ref country code: NO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240620

Ref country code: LT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240320

Ref country code: HR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240320

Ref country code: GR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240621

Ref country code: FI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240320

Ref country code: BG

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240320

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: FR

Payment date: 20240611

Year of fee payment: 7

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240320

Ref country code: LV

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240320

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: NL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240320

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: NL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240320

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240720

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: DE

Payment date: 20240604

Year of fee payment: 7

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SM

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240320

Ref country code: PT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240722

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: ES

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240320

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: EE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240320

Ref country code: CZ

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240320

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: PL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240320

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240320

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SM

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240320

Ref country code: SK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240320

Ref country code: RO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240320

Ref country code: PT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240722

Ref country code: PL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240320

Ref country code: IS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240720

Ref country code: ES

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240320

Ref country code: EE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240320

Ref country code: CZ

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20240320